CVE-2026-1357 Explained: The Cost of Never Checking Whether Decryption Failed

Overview Item Detail CVE ID CVE-2026-1357 Affected product WPvivid Backup & Migration (WordPress plugin) Affected versions 0.9.123 and earlier Fixed in 0.9.124 CVSS 3.1 9.8 (Critical) — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Type CWE-434 (Unrestricted Upload of File with Dangerous Type); root cause is a cryptographic fail-open combined with missing path validation Authentication required None (though a plugin "Key" must have been generated at least once beforehand) Reported by Lucas Montes (NiRoX), via Wordfence Install base Installed on more than 800,000 WordPress sites WPvivid Backup & Migration is a plugin that creates WordPress backups and moves them to another server. To transfer backup data between sites securely, the plugin implements its own protocol: it encrypts backup chunks with an AES session key, which is itself wrapped in RSA. The cryptographic design is sound on paper. The problem is that it never answered one question: what